From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 208B8C636D7 for ; Mon, 30 Jan 2023 09:26:24 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id AEC6B6B0072; Mon, 30 Jan 2023 04:26:23 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A75BB6B0073; Mon, 30 Jan 2023 04:26:23 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 8C8D16B0074; Mon, 30 Jan 2023 04:26:23 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 771FC6B0072 for ; Mon, 30 Jan 2023 04:26:23 -0500 (EST) Received: from smtpin30.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 4DF141C602F for ; Mon, 30 Jan 2023 09:26:23 +0000 (UTC) X-FDA: 80410934646.30.7E17F87 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by imf08.hostedemail.com (Postfix) with ESMTP id 2A4EB160016 for ; Mon, 30 Jan 2023 09:26:20 +0000 (UTC) Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=ea1kyU8d; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf08.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1675070781; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=vnEWQUSw8JxK0U8nGwdoLi/zEuKRzSDFmH5aEjEeKDQ=; b=U6CqK+GoTrbhq64Kuh8Hebr+6u2FUaDpG40AmWOM5hwy4phUbAdJxXMQ8Cdar4z1moVypq Ti3yRJhH2Ad+Rf+FTKtFmps2FLIeZr9BS8wyXqFKAljAxmUCSPxEnk08tu4qUwM3TpNVYK eppA1QtjqR2sI+hZWA8yuXHqT9iKnqk= ARC-Authentication-Results: i=1; imf08.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=ea1kyU8d; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf08.hostedemail.com: domain of david@redhat.com designates 170.10.129.124 as permitted sender) smtp.mailfrom=david@redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1675070781; a=rsa-sha256; cv=none; b=tNcTt5KM8ORQUa7MltosS8en1Abt1nHmzBiqOvLVDkFrEh3oUEm34Pb3JZE4B/UhaHk3Iz MzdCbJC1Z0PCCjsbphRJL/UAZ7J9KLcPbDdroKhKtiYJDBR2Rkf3TBHtzfFPjsj2XEGRJ7 Xyabti1wtK7rqY1172aw7jVCYMhHDEA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1675070780; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vnEWQUSw8JxK0U8nGwdoLi/zEuKRzSDFmH5aEjEeKDQ=; b=ea1kyU8d9mJXZDZBNbC5+rZ6YXwnnmYISvOAGuNizEV1ybgyYeePwiQ5BWOosYXNarNTf3 1UE6USEkA3MIVKNK9mXQVO9kA6IDqsXRhwNnecQ/+R4bokQKukNmvmzJHn4lOrPytnz9wh z8avZQsDRmQBQ7dDW3Qfxsq9tRqPa80= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-647-TR6En530Oka5GIeBVkYmKA-1; Mon, 30 Jan 2023 04:26:19 -0500 X-MC-Unique: TR6En530Oka5GIeBVkYmKA-1 Received: by mail-wr1-f72.google.com with SMTP id w23-20020adf8bd7000000b002bfbf6f23feso1733518wra.18 for ; Mon, 30 Jan 2023 01:26:19 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:in-reply-to:organization:references:cc:to :from:content-language:subject:user-agent:mime-version:date :message-id:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=vnEWQUSw8JxK0U8nGwdoLi/zEuKRzSDFmH5aEjEeKDQ=; b=1w7h303EU0UZ4p4dSP8099mMUePBeWKpaXeLo2SLK8rgK+F2gijnWiWUb+B72+hVTA Jyxo/usCkBp2rfa8xqzru4mj3LYNR4XgqsGQ0d2L1GULpYHRuSW936Tkb6nUkPhcQJm2 Cz346tI8kRDzfaCcchgFv7VngffDsVuP2gsfVwAo5sTHXLdgmgf1r4RBE2wgVG3vHId5 3AJHQQvTwE+l1FFIyvVIhvfqjyzBPqNGLkIV78Nd7pcJ86+W6ryMIept7TI6AVU5pLh5 SiQaictxDs9c+jU5Mqa6OAy3IFLojQ+hYwo1yPyrl3i7VHKy7GDnZYHBENgChxRd38Rx T/3A== X-Gm-Message-State: AO0yUKX7VHWfH2eT+LvEtR4ACdPT6c5lb7wNakdeurAWeA5MIWvK6qKS yUCW1ytMMWP8QtbXAmP5UxEhFtmIb2Qmg685prmVyG9LL7Rrg48cOeU2BEL6M74jHVQNscTVa2w Bt7OZKulM1Pg= X-Received: by 2002:a5d:404c:0:b0:2bf:ea00:8142 with SMTP id w12-20020a5d404c000000b002bfea008142mr3595138wrp.34.1675070778232; Mon, 30 Jan 2023 01:26:18 -0800 (PST) X-Google-Smtp-Source: AK7set/DWMnJx7SNtGfZSq5YYcHFEeGb8BelXSZ8JUB9iMWEO5v3R7w2rAp/wavW9aDThk64AmJJ0Q== X-Received: by 2002:a5d:404c:0:b0:2bf:ea00:8142 with SMTP id w12-20020a5d404c000000b002bfea008142mr3595123wrp.34.1675070777891; Mon, 30 Jan 2023 01:26:17 -0800 (PST) Received: from ?IPV6:2003:d8:2f16:1800:a9b4:1776:c5d9:1d9a? (p200300d82f161800a9b41776c5d91d9a.dip0.t-ipconnect.de. [2003:d8:2f16:1800:a9b4:1776:c5d9:1d9a]) by smtp.gmail.com with ESMTPSA id g8-20020adfe408000000b002bdda9856b5sm11468378wrm.50.2023.01.30.01.26.16 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 30 Jan 2023 01:26:17 -0800 (PST) Message-ID: <92076c0e-1eee-66a4-6342-202989c32955@redhat.com> Date: Mon, 30 Jan 2023 10:26:16 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.6.0 Subject: Re: kernel BUG in page_add_anon_rmap From: David Hildenbrand To: Hugh Dickins , "Liam R. Howlett" Cc: Matthew Wilcox , Sanan Hasanov , "akpm@linux-foundation.org" , "linux-mm@kvack.org" , "linux-kernel@vger.kernel.org" , "contact@pgazz.com" , "syzkaller@googlegroups.com" , Huang Ying References: <713c6242-be65-c212-b790-2b908627c1b4@google.com> <9d8fb9c-1b81-67cd-e55b-34517388e1ab@google.com> <67dfd817-073e-9abb-316f-689ba8193965@redhat.com> Organization: Red Hat In-Reply-To: <67dfd817-073e-9abb-316f-689ba8193965@redhat.com> X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 2A4EB160016 X-Rspamd-Server: rspam09 X-Rspam-User: X-Stat-Signature: wfcz9d7s69h7rgq7kfx3k5nokh6dsh41 X-HE-Tag: 1675070780-315372 X-HE-Meta: U2FsdGVkX18EGTiCMsTCsQnfjt6TMBMFjAGhnEWEqb0SSOjo3+0emtBYk0AoTWyXEAhhGDMqbO2hRsjimEimEzUk1rjhpags9XKHFwwj5cKIk6DtwvYeNGfXhCVaxc6pdfa8O1Dh+QYOnoYuPEtvZl3ZZJDfJtRE2IIj0byKMbj0bz/piVurYPNUYk4puVzC9SDBWJDT5iLz3W6OkTB5OrP8SzCE8qdz7a1FRZ3jnzh6PaFSw8+C7tNlts4pI+fzdaGiRO3XwKz+XgJDdPEdBF4rfrNhH7gIIRMDhh6/bV0T0gqRofJ1yMBL01W7H2IWXAtIT7tUnHSm1o5asgj+3vw0rtR7ws6AglUFlt1ETxdef1LmqZFikbsVdrj6t5YU8v1Mf14cM+NbZzbrHdu7b+Oms02YSy/GXeHPCfGMcBxTVidgP3nA7zx/TP6lcWqjmFKUXtlaPNSsIdQZoIKCj35sBHkQCq1HMKfHEpzZE6nvkHiZ01vAe9MMq2LSGSSfKDU+hIQtOP8RbhqJNet9kuuVi3Uj4WfFAg7qzufINLVGVFb8+GjAdf8w2rqYn6mpfPmqBXq7QB1kK1y+awDNeSBV93Kzy5MndZtbUC5w3zBc2PL12BLE/XUgCY+7oyHG6apPdwpF4QLWpS5ALJEVAshBAoSf7imLRjAZgpN/SfZHKDinWOSbPvEvdDRdw0tNjVBHxflUq9KunNvweczoAHC123WYTz4QJkC8b8NMitmMhEx69vVLYwtogOna+q694Yh/k2C7uQFpgN33lPE92d3HKa/XImRZruUrdKyuORg7lRNRwGVCgNMFLRYO4lTLhmBEm5MDZpTJ4R2FJqLTYnBspomI1RNE92gqEgCl+pUC1c9TkFVimtReYRl4W8xNXRXPU+zFa5ea99J9y/WLWxYgjTWGk7rLRel2hkG3XQ4gbbuyxQL9ktnoigAwe3ohN3iIuqSalp2qX8R7niQ 0PSa0o5m A4f1f6/V1PHgNza5Ibs0b/XxfJhM2rWkv5AXcjX0LA86VZhhVBN0z2ZbP3mGMLgDn3sOqKXW19MTk8zecrE2fgHoSj2nd6h242EYzAaXjDj+zk09lRdSpK8cvyhazLABTYEIq63srB173lfaR43xRC0tdHAPbWHJC01YilY+qWi/5t3q2Fp6WFD804kfo6tf0p8uLmbjN7nvBop9R58+yPouJg93v3/biqzuPZpKve3USv0Hckk4UV3C+opBqxYsViNoCE9pjbatKdDcJpj1Zf7aa57I2pyNXOmb2D114K6EGn3AvbreZJJCEFfv/U2q55Nuu6pM47xpknXRZNSA5fwy+zjil+tfZsbituT3/RsEVar+iQUIVIYmpuomKzgJauHpJLWLTg1KxHj4u1os1wfV5WYLDTQLYSufji2K6vo3AWhgQ9qweqkotH7XKkPbi5wpD3fh2y2Jq7nmSC8Cuvv/MNGd+W1OOb2lyoqFCzKP2CXo= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 30.01.23 10:03, David Hildenbrand wrote: >>>> >>>> I reproduced on next-20230127 (did not try upstream yet). >> >> Upstream's fine; on next-20230127 (with David's repro) it bisects to >> 5ddaec50023e ("mm/mmap: remove __vma_adjust()"). I think I'd better >> hand on to Liam, rather than delay you by puzzling over it further myself. >> > > Thanks for identifying the problematic commit! ... > >>>> >>>> I think two key things are that a) THP are set to "always" and b) we have a >>>> NUMA setup [I assume]. >>>> >>>> The relevant bits: >>>> >>>> [ 439.886738] page:00000000c4de9000 refcount:513 mapcount:2 >>>> mapping:0000000000000000 index:0x20003 pfn:0x14ee03 >>>> [ 439.893758] head:000000003d5b75a4 order:9 entire_mapcount:0 >>>> nr_pages_mapped:511 pincount:0 >>>> [ 439.899611] memcg:ffff986dc4689000 >>>> [ 439.902207] anon flags: >>>> 0x17ffffc009003f(locked|referenced|uptodate|dirty|lru|active|head|swapbacked|node=0|zone=2|lastcpupid=0x1fffff) >>>> [ 439.910737] raw: 0017ffffc0020000 ffffe952c53b8001 ffffe952c53b80c8 >>>> dead000000000400 >>>> [ 439.916268] raw: 0000000000000000 0000000000000000 0000000000000001 >>>> 0000000000000000 >>>> [ 439.921773] head: 0017ffffc009003f ffffe952c538b108 ffff986de35a0010 >>>> ffff98714338a001 >>>> [ 439.927360] head: 0000000000020000 0000000000000000 00000201ffffffff >>>> ffff986dc4689000 >>>> [ 439.932341] page dumped because: VM_BUG_ON_PAGE(!first && (flags & (( >>>> rmap_t)((((1UL))) << (0))))) >>>> >>>> >>>> Indeed, the mapcount of the subpage is 2 instead of 1. The subpage is only >>>> mapped into a single >>>> page table (no fork() or similar). >> >> Yes, that mapcount:2 is weird; and what's also weird is the index:0x20003: >> what is remove_migration_pte(), in an mbind(0x20002000,...), doing with >> index:0x20003? > > I was assuming the whole folio would get migrated. As you raise below, > it's all a bit unclear once THP get involved and dealing with mbind() > and page migration. > >>>> >>>> I created this reduced reproducer that triggers 100%: >> >> Very helpful, thank you. >> >>>> >>>> >>>> #include >>>> #include >>>> #include >>>> #include >>>> >>>> int main(void) >>>> { >>>> mmap((void*)0x20000000ul, 0x1000000ul, PROT_READ|PROT_WRITE|PROT_EXEC, >>>> MAP_ANONYMOUS|MAP_FIXED|MAP_PRIVATE, -1, 0ul); >>>> madvise((void*)0x20000000ul, 0x1000000ul, MADV_HUGEPAGE); >>>> >>>> *(uint32_t*)0x20000080 = 0x80000; >>>> mlock((void*)0x20001000ul, 0x2000ul); >>>> mlock((void*)0x20000000ul, 0x3000ul); >> >> It's not an mlock() issue in particular: quickly established by >> substituting madvise(,, MADV_NOHUGEPAGE) for those mlock() calls. >> Looks like a vma splitting issue now. > > Gah, should have tried something like that first before suspecting it's > mlock related. :) > >> >>>> mbind((void*)0x20002000ul, 0x1000ul, MPOL_LOCAL, NULL, 0x7fful, >>>> MPOL_MF_MOVE); >> >> I guess it will turn out not to be relevant to this particular syzbug, >> but what do we expect an mbind() of just 0x1000 of a THP to do? >> >> It's a subject I've wrestled with unsuccessfully in the past: I found >> myself arriving at one conclusion (split THP) in one place, and a contrary >> conclusion (widen range) in another place, and never had time to work out >> one unified answer. > > I'm aware of a similar issue with long-term page pinning: we might want > to pin a 4k portion of a THP, but will end up blocking the whole THP > from getting migrated/swapped/split/freed/ ... until we unpin (ever?). I > wrote a reproducer [1] a while ago to show how you can effectively steal > most THP in the system using comparatively small memlock limit using > io_uring ... > Correction, my reproducer already triggers a compund page split to really only pin a 4k page, to then free the remaining 4k pages of the previous THP. As a single 4k page is allocated and pinned, we cannot get a THP at these physical memory locations until the page is unpinned. -- Thanks, David / dhildenb